The setup page keeps waiting
Check the deployment finished in the Azure portal (resource group → Deployments). The agent retries registration every few minutes. If the setup code expired or was already used, choose New token in CloudLens and run the setup again into the same resource group: the agent picks up the new code by itself.
Connected, but no data yet
Right after setup, Azure can take a while to apply the agent’s read access. The agent tries again every 30 minutes until its first collection succeeds, so data usually appears within the hour.
“Authorization failed … Microsoft.Resources/deployments/write”
You chose the whole tenant or a management group without being Owner at the top of the tenant (/). Nothing was created and your setup code still works. Do the optional step in Covering the whole tenant (Permissions and scope) and deploy again, or choose a single subscription.
“You need Owner or User Access Administrator”
You can’t grant roles on the scope you chose. Choose a subscription where you are Owner, or ask a Global Administrator to cover the whole tenant (see Permissions and scope).
The deployment was blocked by a policy
An Azure Policy in your organization prevents one of the resources (often the AI service or a network setting). Ask your administrator to allow it, or install without the AI Advisor.
The AI model isn’t available
Choose another region or the “anywhere in Azure” processing option, or install without the AI Advisor and add it later.
A data source says “Needs attention”
Wait ten minutes for roles to apply and choose Collect again now. If it says Defender isn’t enabled, turn on Microsoft Defender for Cloud (free tier is fine).
No cost data
New subscriptions can take up to a day. Free-trial, sponsorship and some reseller subscriptions don’t provide cost data to read.
Numbers differ from the Azure portal
CloudLens shows actual cost up to yesterday; compare the same dates with “Actual cost” in Cost analysis. Savings are Advisor’s estimates; idle resources use list prices.
An action I fixed came back
The latest check still found the issue — for example another network rule still allows remote desktop. Open the action and check each step.